IN THE CLAIMS 



Please amend the claims as follows; 
Listing of Claims 

1 . (Currently Amended) A network monitoring system that monitors a communication 
within a network including a plurality of terminals, the terminals including at least a client and a 
server, the terminals communicating a plurality of action contents with each other, each action 
content having consisting of a group of associated packets, the network monitoring system 
comprising: 

a data acquisition section that acquires a plurality of packets flown on the [[a]] network; 

a data analysis section that analyzes analys e s each of the packets to extract the group of 
associated packets from all the packets and that acquires an action content from the group of 
associated packets, the data analysis section extracting a plurality of groups of the associated 
packets and acquiring a plurality of action contents therefrom; 

a display-information generation section that generates [[a]] display information by 
chronologically aligning the plurality of action contents to correspond to respective times when 
the action contents are actually communicated; and 

a display unit that displays an association graph indicating the terminals within the 
network and that overlaps additional objects on the association graph, the additional objects 
being generated in accordance with the display, the additional objects being overlapped on the 
association graph in a chronological order correspond in g to the respective times along with a 
s equ e nee-o f when the action contents are actually communicated, 

2 



wherein the additional objects include: 

the type of operating system employed by the client, 
the type of operating system employed by the server, 
an account name of a user accessing the client, and 
an icon representing the account name. 

2. (Previously Presented) The network monitoring system according to claim 1, wherein 
the action content is defined in advance. 

3. (Currently Amended) The network monitoring system according to claim 1 , wherein 
the data analysis section identifies kinds of the packets acquired by the data acquisition section 
and acquires the action content from the packets on the basis of the identified kinds of [[the]] 
packets. 

4. (Previously Presented) The network monitoring system according to claim 1 , wherein 
the action content includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 
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5. (Currently Amended) The network monitoring system according to claim 1, further 
comprising: 

an analysis data storage section that stores the action content acquired by the data 
analysis section, wherein: 

the display-information generation section regenerates [[the]] information of when the 
action contents are communicated t h e- s equence of in d ividual actions that -oc curred onth e- 
network from the action content stored by the analysis data storage section. 

6. (Currently Amended) The network monitoring system according to claim 5, wherein: 
the action content stored by the analysis data storage section includes time information, 

which corresponds to the time at which a [[the]] single action occurred; and 

the display-information generation section determines the time interval, withinthfr- 
sequence; that each individual action occurred using the time information stored by the analysis 
data storage section. 



7. (Currently Amended) The network monitoring system according to claim 5, wherein 
the display- in formation generation section continuously regenerates the association graph and 
overlap ping; additional objects s e quence after each predetermined period, which period is 
accurate within 500 milliseconds. 
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8. (Currently Amended) The network monitoring system according to claim 1, wherein 
the display-information generation section extracts and generates [[the]] information of each 
action occurring on the network in accordance with a display setting set by a user. 

9. (Currently Amended) A network monitoring method for monitoring a communication 
within a network including a plurality of terminals, the terminals including at least a client and a 
server, the terminals communicating a plurality of action contents with each other, each action 
content havin g consisting of a group of associated packets, the method comprising: 

acquiring a plurality of packets flown on the [[a]] network; 

analyzing each of the packets to extract the group of associated packets from all the 
packets and acquiring an action content from the group of associated packets, and extracting a 
plurality of groups of the associated packets and acquiring a plurality of action contents 
therefrom; 

generating display information by chronologically aligning the plurality of action 
contents to correspond to respective times when the action contents are actually communicated; 
and 

displaying a- di s play unit that displays an association graph indicating the terminals 
within the network and overlapping that over laps additional objects on the association graph, the 
additional objects being generated in accordance with the display, the additional objects being 
overlapped on the association graph in a chronological order corresponding to the respective 
times along- w ith ■ a-s e quene e- ef when the action contents are actually communicated, 

wherein the additional objects include; 
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the type of operating system employed by the client, 
the type of operating system employed by the server, 
an account name of a user accessing the client, and 
an icon representing the account name. 

10. (Previously Presented) The network monitoring method according to claim 9, 
wherein the action content is defined in advance. 

1 1 . (Currently Amended) The network monitoring method according to claim 9, 
wherein in the acquisition of the action content, kinds of the packets acquired by the packet 
acquisition are identified and the action content is acquired from the packets on the basis of the 
identified kinds of [[the]] packets. 

12. (Previously Presented) The network monitoring method according to claim 9, 
wherein the action content includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 
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13. (Currently Amended) The network monitoring method according to claim 9, further 
comprising: 

storing the acquired action content, wherein: 

[[the]] information of when the action contents are communicated th e s equence of ■ 
individual- actions that occurred on the network is regenerated from the stored action content. 

14. (Currently Amended) The network monitoring method according to claim 13, 
wherein: 

the stored action content includes time information, which corresponds to the time at 
which a [[the]] single action occurred; and 

the time interval F within the sequenG e , - that each individual action occurred is determined 
using the stored time information. 

15. (Currently Amended) The network monitoring method according to claim 13, 
further comprising continuously regenerating the association gra ph and overlapping additional 
objects sequ en ce after each predetermined period, which period is accurate within 500 
milliseconds. 

16. (Currently Amended) The network monitoring method according to claim 9, 
wherein [[the]] information of each action occurring on the network is extracted and generated in 
accordance with a display setting set by a user. 
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17. (Currently Amended) A network monitoring program recorded on a non- transitory 
computer readable storage medium and executable by a computer, the program making the 
computer monitor a communication within a network including a plurality of terminals, the 
terminals including at least a client and a server, the terminals communicating a plurality of 
action contents with each other, each action content having consisting of a group of associated 
packets, and perform a process comprising: 

acquiring a plurality of packets flown on the [[a]] network; 

analyzing each of the packets to extract the group of associated packets from all the 
packets and acquiring an action content from the group of associated packets, and extracting a 
plurality of groups of the associated packets and acquiring a plurality of action contents 
therefrom; 

generating display information by chronologically aligning the plurality of action 
contents to correspond to respective times when the action contents are actually communicated; 
and 

displaying a display unit thai-display* an association graph indicating the terminals 
within the network and overla ppin g that overlaps additional objects on the association graph, the 
additional objects being generated in accordance with the display, the additional objects being 
overlapped on the association graph in a chronological order correspondin g to the respective 
times al o ng with a sequence of when the action contents are actually communicated, 
wherein the additional objects include 

the type of operating system employed by the client, 
the type of operating system employed by the server, 
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an account name of a user accessing the client, and 
an icon representing the account name. 

18. (Original) The network monitoring program according to claim 17, wherein the 
action content is defined in advance. 

19. (Currently Amended) The network monitoring program according to claim 17, 
wherein in the acquisition of the action content, kinds of the packets acquired by the packet 
acquisition are identified and the action content is acquired from the packets on the basis of the 
identified kinds of [[the]] packets. 

20. (Previously Presented) The network monitoring program according to claim 1 7, 
wherein the action content includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 

21. (Currently Amended) The network monitoring program according to claim 17, 
wherein; 
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the process further comprises storing the acquired action content; and 
[[the]] information of when the action contents are communicated the- s equence of 
i ndividual actions that e e - eu - r^ e d-en - the netweric - is regenerated from the stored action content. 

22. (Currently Amended) The network monitoring program according to claim 21 . 
wherein: 

the stored action content includes time information, which corresponds to the time at 
which a [[the]] single action occurred; and 

the time interval , within the sequ e nce, that each individual action occurred is determined 
using the stored time information. 

23. (Currently Amended) The network monitoring program according to claim 21, 
wherein the process further comprises continuously regenerating the association graph and 
overlapping additional objects sequence after each predetermined period, which period is 
accurate within 500 milliseconds. 

24. (Currently Amended) The network monitoring program according to claim 17, 
wherein [[the]] information of each action occurring on the network is extracted and generated in 
accordance with a display setting set by a user. 
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25. (Currently Amended) The network monitoring system of claim 1, wherein the 
display unit displays a graphical representation of a [[the]] communication connection between 
the client and the server. 

26. (Currently Amended) The network monitoring method of claim 9, further 
comprising dis playing wherein the d is play unit displays a graphical representation of a [[the]] 
communication connection between the client and the server. 

27. (Currently Amended) The network monitoring program of claim 17, further 
comprising displaying wherein the display unit - displays a graphical representation of a [[the]] 
communication connection between the client and the server. 
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